Public-ready: MIT license, security and contributing docs; upgrade web dependencies

.github/workflows/web.yml

@@ -26,7 +26,7 @@ jobs:
           version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing
+
+Thanks for looking at TinyCompiler. It is a small compiler for a small tensor language, and the
+bar for changes is that every result stays checked against a numpy oracle on the real chips.
+
+## Set up
+
+```bash
+git submodule update --init
+python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pip install -e targets/tiny-gpu --no-deps
+source scripts/env.sh
+```
+
+For the Compiler Explorer:
+
+```bash
+cd web && pnpm install && pnpm dev
+```
+
+`pnpm dev` regenerates the Python bundle and the example list first (`scripts/build_web.py`).
+
+## Before you open a pull request
+
+Run the same checks CI runs:
+
+```bash
+ruff check . && black --check .
+pytest -q
+cd web && pnpm lint && pnpm typecheck && pnpm test && pnpm e2e
+```
+
+- **Golden files** (`tests/golden/`) pin the emitted IR and assembly. If you change emitted
+  output on purpose, review the diff and run `pytest --update-golden`.
+- **Measured numbers** in `docs/ARCHITECTURE.md` come from `scripts/opt_table.py --write`. A test
+  fails if they drift.
+- Do not format `targets/` (the hardware submodules); the formatter config excludes it.
+
+## Branches and pull requests
+
+- Work on a `feat/*`, `fix/*` or `docs/*` branch. `main` is the default branch and is not pushed to
+  directly.
+- Keep a pull request to one change. Describe what changed and how you checked it.
+- Add a regression test for each bug you fix. A minimized failing program can go in
+  `tests/regressions/`.
+
+## Reporting bugs
+
+Open an issue with the `.tiny` program that fails, the command you ran, and what you expected. A
+minimal program makes the fix much faster. For security problems, see [SECURITY.md](SECURITY.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dineth Hettiarachchi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,30 @@
+# Security policy
+
+## Supported versions
+
+Only the latest code on `main` is supported. TinyCompiler is an educational compiler and
+simulator project; it has no releases yet.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a security problem.
+
+Report it privately through GitHub: open the repository's **Security** tab and choose
+**Report a vulnerability**. The report stays private until a fix is ready.
+
+Include, if you can:
+
+- what you ran (a `.tiny` program, a command, or a page of the Compiler Explorer),
+- what you expected and what happened,
+- the commit you tested.
+
+You should get an acknowledgement within a few days. A fix will land on `main`, and the report
+will be credited there unless you ask otherwise.
+
+## Scope
+
+In scope: the compiler (`tinyc/`), the runners (`runtime/`), the Compiler Explorer (`web/`), and
+the build and CI scripts.
+
+Out of scope: the tiny-gpu and tiny-tpu hardware designs, which are separate projects with their
+own security contacts, and problems that need a compromised machine to exploit.

web/package.json

@@ -15,9 +15,9 @@
     "e2e": "pnpm build && playwright test"
   },
   "dependencies": {
-    "@astrojs/react": "^4.0.0",
+    "@astrojs/react": "^7.1.1",
     "@codemirror/state": "^6.7.6",
-    "astro": "^5.0.0",
+    "astro": "^7.4.2",
     "codemirror": "^6.0.2",
     "framer-motion": "^12.43.0",
     "react": "^18.3.1",
@@ -26,14 +26,14 @@
   "devDependencies": {
     "@astrojs/check": "^0.9.12",
     "@eslint/js": "^9.39.5",
-    "@playwright/test": "1.48.2",
+    "@playwright/test": "1.64.1",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "eslint": "^9.39.5",
     "globals": "^15.15.0",
     "typescript": "^5.6.3",
     "typescript-eslint": "^8.72.0",
-    "vitest": "^2.1.9"
+    "vitest": "^4.1.12"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

web/playwright.config.ts

@@ -1,12 +1,13 @@
 import { defineConfig, devices } from "@playwright/test";
 
-// The smoke test runs against `astro preview` of a fresh build (see the `e2e` script).
+// The smoke test runs against the static build in dist/ (the `e2e` script builds it first).
 export default defineConfig({
   testDir: "e2e",
   timeout: 180_000,
   use: { baseURL: "http://127.0.0.1:4321" },
   webServer: {
-    command: "pnpm preview --port 4321 --host 127.0.0.1",
+    // A plain static server: Astro 7's `preview` daemonises, which Playwright reads as an early exit.
+    command: "python3 -m http.server 4321 --bind 127.0.0.1 --directory dist",
     url: "http://127.0.0.1:4321/app",
     reuseExistingServer: true,
     timeout: 60_000,